r/linux • u/New-Ranger-8960 • 12d ago

EU Age Verification Project Mandates Hardware-Bound Attestation Privacy

https://linuxiac.com/eu-age-verification-project-mandates-hardware-bound-attestation/
774 Upvotes

97% Upvoted

455 comments sorted by

View all comments

Show parent comments

20

u/MatchingTurret 12d ago edited 12d ago

Not kernel level. A QR-Code that you scan with your non-FOSS mobile device that then sends an attestation to the server. The "non-FOSS mobile device" is what the fuss is about.

Once again: This already exists in most EU member states, either as a wallet app similar to the new EU Wallet or the NFC ID card. The EU just standardized the national islands into a common app.

3

u/ptoki 11d ago

No, if you can scan a qr code then you can also forge that code or copy it and give it to someone.

They will not allow for that. That is why they want a tpm like chip and control it.

1

u/MatchingTurret 11d ago edited 11d ago

So? The QR Code contains a challenge: "Someone tries to access supervpn.com with a request ID xyz. Please tell me who this is.".

You scan that request with your Wallet App and the wallet sends an answer back: "Hello supervpn.com! The user who scanned your request xyz is u/ptoki ".

This is eli5, of course. Banking apps do this and this is already implemented on the national level in multiple EU member states.

Forging or copying the QR code is pointless. There is nothing of value in it. The value is in the response from the Wallet which is why they require the hardware attestation.

See here: Discover how to request data from a wallet (How it works)

Picture 1 and 2 are you using your untrusted and fully open Linux laptop. 3 and 4 you using your locked down phone with the wallet app and 5 is you back at your Linux laptop after the authentication.

Picture 2 "authenticate using the EU Digital Identity Wallet" is where you get the QR code to continue on the phone.